# Deposit and withdraw to the vault with the wrong decimals of amount in contract `PerpDepository`

PerpDepository passed 18-decimal amounts to vault.deposit/withdraw for non-18-decimal tokens like USDC, causing wrong-scale deposits and potential fund loss.

- Payout: Contest reward
- Severity: medium
- Program: Uxd
- Credited: berndartmueller
- Disclosed: 2022-12-27
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-uxd-judging/issues/402
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** PerpDepository vault deposit/withdraw integration
**Root cause:** _placePerpOrder returns amounts normalized to 18 decimals, but vault.deposit/withdraw expect amounts in the token's native decimals (e.g. 6 for USDC); the rebalance functions pass the 18-decimal value directly without conversion.
**Steps:**
1. Read PerpDepository._depositAsset: vault.deposit(assetToken, amount) expects native token decimals.
2. Inspect _rebalanceNegativePnlWithSwap: (baseAmount, quoteAmount) = _placePerpOrder(...) returns 18-decimal values.
3. Observe `vault.deposit(quoteToken, quoteAmount)` passes 18-decimal quoteAmount for a 6-decimal token like USDC.
4. Trigger a negative PnL rebalance with USDC quote to deposit a 10^12-scaled amount, causing over/under-deposit or allowance revert.
**How found:** Code review comparing the decimal convention of _depositAsset (native decimals) against _placePerpOrder's 18-decimal return, spotting the missing conversion at the vault.deposit call in the rebalance path.
**Exploitation:** Not weaponized; a rebalance path with a non-18-decimal quote token (USDC) would deposit an amount scaled 10^12 too large, draining or reverting vault operations.
**Insight:** When a helper returns normalized 18-decimal values, audit every downstream external call that expects native token decimals—especially in rebalance/PnL paths where the token may be USDC/WBTC rather than 18-decimal.